PT-2010-4052 · Php · Php

Tomas Hoger · Publicado 2010-08-20 · Atualizado 2016-08-23 · CVE-2010-2484

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.14

Description The issue allows context-dependent attackers to obtain sensitive information, such as memory contents, or trigger memory corruption. This can be achieved by causing a userspace interruption of an internal function or handler, specifically through the strrchr function.

Recommendations For PHP versions prior to 5.2.14, update to version 5.2.14 or later to resolve the issue. As a temporary workaround, consider restricting the use of the strrchr function until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2010-2484

Produtos afetados

Php

Referências · 10

• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Aviso do Fabricante
• http://support.apple.com/kb/HT4312 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2484 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=619324 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2484 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=133469208622507&w=2 · Aviso do Fabricante
• http://php.net/releases/5_2_14.php · Nota
• http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html · Aviso do Fabricante
• http://support.apple.com/kb/HT4435 · Nota